Authority management method and device for system release, computer equipment and medium

Abstract

The invention relates to the technical field of release process optimization and authority management, and discloses an authority management method and device for system release, computer equipment and a medium, and the method comprises the steps: receiving system release request information comprising system information, release time, a transfer node and a processor corresponding to the transfer node; according to the system information and the transfer nodes, authorities are distributed to corresponding processing persons; determining a permission review level according to the system information and the release time; in the process of processing the transfer node by the processor, detecting whether the processor has an unauthorized behavior or not according to the authority review level; and if the unauthorized behavior exists, determining an alarm level according to the unauthorized behavior and the authority review level to give an alarm. According to the method, all stages of system publishing are subjected to refined integrated management and control, the authority management level in the system publishing process is improved, an unauthorized behavior is detected and reminded in real time in the system publishing process, and the safety of the system publishing process is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of publishing process optimization and authority management, and in particular to a method, device, computer equipment and medium for authority management of system publishing. Background Art

[0002] As enterprises or organizations become more and more dependent on informatization, the frequency of system releases and updates is increasing. System releases involve deploying newly developed or updated applications to production environments or user ends. In this process, if there is no strict control and security mechanism, it may be exploited by malicious attackers, resulting in serious consequences such as data leakage, function tampering, and release interruption during system release.

[0003] How to ensure that only legal and authorized operations can be performed and prevent unauthorized behavior from causing damage to system release is the key to ensuring the safe release of the system. In the prior art, access control lists, role-based access control, single sign-on technology, security auditing and other methods are usually used for permission control, and vulnerability scanning tools, penetration testing and other methods are used for unauthorized detection. However, the permission management method of the prior art lacks an integrated control mechanism for each stage of system release, and there may be problems with the connection between different permission control measures. Moreover, unauthorized detection is a post-detection, which makes it difficult to timely discover and prevent unauthorized behavior during the system release process.

[0004] Therefore, there is an urgent need for a permission management method that can integrate the management and control of each stage of system release and detect and remind unauthorized behavior in real time during the system release process. Summary of the invention

[0005] The present invention provides a permission management method, device, computer equipment and medium for system release, which improves the permission management level in the system release process by performing refined integrated management and control on each stage of system release, detects and reminds unauthorized behavior in real time during the system release process, and improves the security of the system release process.

[0006] In a first aspect, a method for managing rights for system release is provided, comprising:

[0007] Release request information; wherein the system release request information includes: system information, release time, flow node and the processor corresponding to the flow node;

[0008] Assign permissions to corresponding processors based on system information and flow nodes;

[0009] Determine the permission review level based on system information and release time;

[0010] When the processor is processing the flow node, check whether the processor has exceeded his authority according to the authority review level;

[0011] If there is any unauthorized behavior, the alarm level will be determined based on the unauthorized behavior and the authority review level.

[0012] In a second aspect, a rights management device for system release is provided, comprising:

[0013] An information acquisition module is used to receive system release request information; wherein the system release request information includes: system information, release time, flow node and the processor corresponding to the flow node;

[0014] The authority management module is used to assign authority to corresponding processors based on system information and flow nodes;

[0015] The risk assessment module is used to determine the permission review level based on system information and release time;

[0016] The authority-exceeding detection module is used to detect whether the processor has exceeded its authority according to the authority review level during the process of the processor processing the flow node;

[0017] The alarm response module is used to determine the alarm level according to the unauthorized behavior and the authority review level when there is unauthorized behavior.

[0018] In a third aspect, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned rights management method for system release when executing the computer program.

[0019] In a fourth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above-mentioned rights management method for system release are implemented.

[0020] In the scheme implemented by the above-mentioned permission management method, device, computer equipment and medium for system release, system release request information is received; wherein the system release request information includes: system information, release time, flow node and the processor corresponding to the flow node; according to the system information and the flow node, the corresponding processor is assigned permissions; according to the system information and the release time, the permission review level is determined; in the process of the processor processing the flow node, according to the permission review level, whether the processor has unauthorized behavior; if there is unauthorized behavior, the alarm level is determined according to the unauthorized behavior and the permission review level to issue an alarm. In the present invention, permissions are assigned to the processor corresponding to the flow node of the system, and integrated permission management is implemented for each stage of system release; the permission review level is determined according to the system information and the release time, which improves the flexibility of permission management; in the process of the processor processing the flow node, whether the processor has unauthorized behavior is detected in real time, and the degree of harm of the unauthorized behavior can be discovered and evaluated at the first time; once unauthorized behavior is discovered, corresponding alarm means are taken, which improves the self-protection ability of system release. The method provided by the present invention can improve the authority management level in the system publishing process, improve the security of system publishing, and prevent serious consequences caused by unauthorized behavior during system publishing. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0022] Figure 1 It is a schematic diagram of an application environment of a rights management method for system release in one embodiment of the present invention;

[0023] Figure 2 It is a flowchart of a rights management method for system publishing in one embodiment of the present invention;

[0024] Figure 3 is a flow chart of a rights management method for system publishing in another embodiment of the present invention;

[0025] Figure 4 It is a schematic diagram of the structure of a rights management device for system release in one embodiment of the present invention;

[0026] Figure 5 is a schematic diagram of the structure of a computer device in one embodiment of the present invention;

[0027] Figure 6 It is a schematic diagram of the structure of a computer device in another embodiment of the present invention. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] The rights management method for user system release provided by the embodiment of the present invention can be applied in the following aspects: Figure 1 In an application environment, a client communicates with a server through a network. The client can be, but is not limited to, a personal computer, a laptop, a smart phone, a tablet computer, a portable wearable device, and other devices with a display and input device. The server can be implemented as an independent server or a service platform composed of multiple servers. One server can communicate with multiple clients.

[0030] The system release request information may be sent from the client. The system publisher may send the system release request information to the server through the client, that is, instruct the server to start the authority management of each stage of the system release.

[0031] The processing of the transfer node can be performed through the client. When each processor processes the transfer node released by the system through its client, the server detects whether the processor has exceeded its authority.

[0032] The client of the system publisher and the client of each processor can be the same client or different clients. Generally speaking, the client of the system publisher and the client of each processor are different clients.

[0033] The server first receives the system release request information including system information, release time, transfer node and the processor corresponding to the transfer node from the client, allocates authority to the corresponding processor according to the system information and the transfer node, determines the authority review level according to the system information and the release time, and then detects whether the processor has exceeded the authority according to the authority review level in the process of the processor processing the transfer node. If the processor has exceeded the authority, the alarm level is determined according to the unauthorized behavior and the transfer node and an alarm is issued.

[0034] In the present invention, permissions are allocated to the processors corresponding to the transfer nodes of the system, so as to realize integrated permission management for each stage of the system release; the permission review level is determined according to the system information and the release time, so as to improve the flexibility of permission management; in the process of the processors processing the transfer nodes, it is detected in real time whether the processors have unauthorized behavior, so as to find and evaluate the harm degree of unauthorized behavior at the first time; once unauthorized behavior is found, corresponding alarm means are taken, so as to improve the self-protection ability of the system release. The method provided by the present invention can improve the permission management level in the system release process, improve the security of the system release, and prevent serious consequences caused by unauthorized behavior when the system is released.

[0035] The present invention is described in detail below through specific embodiments.

[0036] During the system release process, each process node usually requires a different processor to process it, so the processor needs to be granted corresponding permissions. While the processor is processing the corresponding process node, a malicious attacker (processor or other person) may tamper with the permissions and exceed the authority, so it is necessary to monitor in real time whether there is any unauthorized operation. The method proposed in the present invention can realize integrated permission management for each stage of system release; it can detect unauthorized behavior in real time and can discover and evaluate the degree of harm of unauthorized behavior in the first time, and take corresponding warning measures once unauthorized behavior is found, thereby improving the self-protection ability of system release.

[0037] See also Figure 2 As shown, Figure 2 A flowchart of a rights management method for system publishing provided by an embodiment of the present invention includes the following steps:

[0038] Step S210: receiving system release request information; wherein the system release request information includes: system information, release time, flow node and the processor corresponding to the flow node.

[0039] The system publishing request information may be request information for system publishing provided by the system publisher to the server through the client.

[0040] The system release request information at least includes, but is not limited to: system information, release time, flow node, and the processor corresponding to the flow node.

[0041] The system information may be basic information of the system, including but not limited to: system type, system name, system version number and other information.

[0042] The release time may be the expected launch time of the system.

[0043] The flow node can be a node for the preparation work required for the release system, which can include but is not limited to: resource configuration, code compilation, environment configuration, etc. The flow node can also include the dependency relationship between the flow nodes, the limit time of each flow node (i.e. the start and end time of each flow node), etc.

[0044] The processor may be the person in charge or the responsible team for processing the corresponding flow node, and may include but is not limited to: processor name, processor level and other personnel information.

[0045] After receiving the system release request information, the server can perform integrated permission management for each stage of the system release based on the system release request information.

[0046] Step S220: assign permissions to corresponding processors based on system information and flow nodes.

[0047] System information can indicate the basic information of the system, and flow nodes can indicate the processing stage of the system. Therefore, the server assigns different permissions to the processors of each flow node based on the system information and flow nodes. The method of assigning permissions may include but is not limited to: manually assigning permissions, assigning permissions using attribute-based access control, and predicting and assigning permissions using artificial intelligence models.

[0048] For example: if the system information indicates that the system is a system related to the insurance field, then when assigning permissions to the processor, the processor can only be granted permissions to access data resources related to the insurance field; if the system information indicates that the system is a system related to the taxation field, then when assigning permissions to the processor, the processor can only be granted permissions to access data resources related to the taxation field; if the system information indicates that the system is a system related to the medical field, then when assigning permissions to the processor, the processor can only be granted permissions to access data resources related to the medical field.

[0049] For another example: if the flow nodes include resource configuration, code compilation, and environment configuration, and code compilation depends on resource configuration, and environment configuration depends on code compilation, then when assigning permissions to processors, permissions are only opened to the code compilation processor after the resource configuration node is processed, and permissions are opened to the environment configuration processor after the code compilation node is processed.

[0050] For another example: when the levels of processors are different, processors at higher levels can be granted more operating permissions (such as the ability to read, write, modify, and delete data resources), while processors at lower levels can be granted fewer operating permissions (such as the ability to read and write data resources).

[0051] Step S230, determine the authority review level based on system information and release time.

[0052] The importance of the system can be determined based on the system information, and the urgency of the system launch can be determined based on the release time. Therefore, the server determines the system's permission review level based on the system information and release time.

[0053] The authority review level is used to indicate the scope and strictness of subsequent detection of whether the processor has exceeded its authority. The higher the authority review level, the larger the scope and the higher the strictness of the detection of whether the processor has exceeded its authority; the lower the authority review level, the smaller the scope and the lower the strictness of the detection of whether the processor has exceeded its authority.

[0054] For example: If it is determined based on system information that it is a system launched for the first time in the insurance field, then the system is more important, so a higher level of authority review can be determined; if it is determined based on system information that it is a system with a minor version update in the medical field, then the system is less important, so a lower level of authority review can be determined.

[0055] For another example: if the expected online time of the system determined based on the release time is close to the current time, then determining a higher permission review level may result in the system being unable to go online as expected, so a lower permission review level can be determined; if the expected online time of the system determined based on the release time is far from the current time, then determining a lower permission review level may provide a time window for malicious attackers to attack, so a higher permission review level can be determined.

[0056] Step S240, during the process of the processor processing the flow node, it is detected whether the processor has exceeded his authority according to the authority review level.

[0057] When the processor processes the transfer node through the client, the client and the server can communicate in real time. Based on the determined authority review level, the server relies on the real-time communication between the client and the server to detect whether the processor has exceeded his authority. The over-authority behavior here is the result determined by the processor's assigned authority and the system's authority review level.

[0058] For example: for a certain system, the processor of a process node of the system has the authority to access data resources related to the insurance field, and the system's authority review level is high (for example, data resources outside the permission range cannot be accessed). Once the server determines that the processor has accessed data resources in other fields (such as the medical field) based on the client, it is determined that the processor has exceeded his authority.

[0059] For another example: for a certain system, the processor of a process node of the system has the authority to access data resources related to the insurance field, and the system's authority review level is low (for example, a limited number of data resources outside the authorized scope). If the server determines that the processor has accessed data resources in other fields (such as the medical field) based on the client, and the number of accesses exceeds the limited limit, then it is determined that the processor is at risk of exceeding authority.

[0060] Step S250: If there is any unauthorized behavior, an alarm is issued according to the level of alarm determined based on the unauthorized behavior and the authority review level.

[0061] Once the server determines that there is an unauthorized behavior, it needs to issue an alarm for the unauthorized behavior. Multiple alarm levels can be determined for different unauthorized behaviors and permission review levels, so as to perform adaptive alarm responses to unauthorized behaviors based on multiple alarm levels.

[0062] That is, when the server detects unauthorized behavior, it automatically responds with the corresponding alarm level based on the severity of the unauthorized behavior and the authority review level.

[0063] For example, for a certain system, the authority of the processor of a process node of the system is to access data resources related to the insurance field. The authority review level of the system is high (for example, data resources outside the authority of non-accessible data). The server detects that the processor has deleted data resources in other fields (such as the medical field) based on the client. Because the overstepping of authority is serious and the authority review level is high, a higher alarm level is triggered to issue an alarm. The higher alarm level can include but is not limited to: interrupting the system release process, locking the authority of the processor, etc.

[0064] For example, for a certain system, the authority of the processor of a process node of the system is to access data resources related to the insurance field. The authority review level of the system is low (for example, limited data resources outside the authority to access). The server detects that the processor has accessed more than the limited limit of data resources in other fields (such as the medical field) based on the client. Since the unauthorized behavior is minor and the authority review level is low, a lower alarm level is triggered to issue an alarm. The lower alarm level can include but is not limited to: outputting and recording alarm prompts to the system publisher, outputting and recording alarm prompts to the processor, etc.

[0065] pass Figure 2The method shown, the present invention receives system release request information; wherein the system release request information includes: system information, release time, transfer node and the processor corresponding to the transfer node; according to the system information and the transfer node, the corresponding processor is assigned authority; according to the system information and the release time, the authority review level is determined; in the process of the processor processing the transfer node, according to the authority review level, whether the processor has unauthorized behavior; if there is unauthorized behavior, the alarm level is determined according to the unauthorized behavior and the authority review level to alarm. In the present invention, the processor corresponding to the transfer node of the system is assigned authority to realize the integrated authority management of each stage of the system release; the authority review level is determined according to the system information and the release time, which improves the flexibility of authority management; in the process of the processor processing the transfer node, the processor is detected in real time whether the processor has unauthorized behavior, and the degree of harm of the unauthorized behavior can be discovered and evaluated at the first time; once the unauthorized behavior is found, the corresponding alarm means are taken, which improves the self-protection ability of the system release. The method provided by the present invention can improve the authority management level in the system release process, improve the security of the system release, and prevent the serious consequences caused by unauthorized behavior when the system is released.

[0066] In some optional implementations, S210 accepts system release request information; wherein, the system release request information includes: system information, release time, flow node and the processor corresponding to the flow node, including: a receiving control for displaying the system release request information; wherein, the receiving control includes: a system information control, a release time control, a flow node control and a processor control; receives the input result of the receiving control, and determines the system information, release time, flow node and the processor corresponding to the flow node.

[0067] The server can receive the system release instruction from the client. Once the server obtains the system release instruction, it will display the receiving control of the system release request information to the client, which at least includes the system information control, the release time control, the flow node control and the processor control.

[0068] The system information control may include, but is not limited to, the following sub-controls: system type sub-control, system name sub-control, system version number sub-control, etc. The system publisher inputs from the system information control, that is, feeds back the system information to the server.

[0069] The flow node control may include, but is not limited to, the following sub-controls: node name sub-control, dependency sub-control, time limit sub-control, etc. The system publisher enters data from the flow node control, that is, feeds back the flow node to the server.

[0070] The handler control may include, but is not limited to, handler name sub-controls, handler level sub-controls, and other subordinate controls. The handler name sub-control may provide candidate handler options for the system publisher to select. The system publisher enters the handler control, that is, feeds back the handler corresponding to the process node to the server.

[0071] In some optional implementations, S220 allocates permissions to corresponding processors based on system information and flow nodes, including: determining the planned permissions of the processor based on attribute-based access control based on the system information and flow nodes; inputting the system information and flow nodes into a pre-trained permission allocation model to obtain the predicted permissions of the processor; wherein the permission allocation model is obtained by training a constructed basic permission allocation model based on historical system information, historical flow nodes, and historical permissions of historical processors corresponding to historical flow nodes; and determining the allocated permissions of the processor based on the predicted permissions and planned permissions.

[0072] The present invention can adopt attribute-based access control and a pre-trained authority allocation model to jointly determine the allocation authority of the processor.

[0073] Attribute-based access control (ABAC) can determine permissions based on the attributes of the subject, object, environment, and operation. After the server obtains the system information, it can determine the object content (such as the data resources that the system needs to access) through the basic information of the system. After the server obtains the process node, it can determine the environment content (such as the permission opening time) through the restricted time of the process node. After the server obtains the handler, it can determine the subject content (such as the handler user subject) through the handler name, and can determine the operation content (such as read, write, delete, etc.) through the handler level.

[0074] The server can use attribute-based access control based on system information and flow nodes to determine the planning permissions of each processor corresponding to each process node. The planning permissions of each processor can be different.

[0075] For example, the planned permissions determined for processor A are: within the time limit of the resource configuration node, he can read, write and delete data resources related to the insurance business.

[0076] For another example, the planned permissions determined for processor B are: within the time limit of the code compilation node, he can read data resources related to the insurance business.

[0077] The authority allocation model is obtained by training the constructed basic authority allocation model based on historical system information, historical flow nodes, and historical authorities of historical processors corresponding to historical flow nodes.

[0078] The server can build a basic permission allocation model. After obtaining the sample set consisting of historical system information, historical flow nodes, and historical permissions, the sample set is input into the basic permission allocation model for iterative training to obtain a trained permission allocation model. The trained permission allocation model can predict the permissions of the processor corresponding to the process node based on the system information and flow nodes.

[0079] For example: Based on the pre-trained permission allocation model, the predicted permissions for processor A can be obtained as follows: within the time limit of the resource configuration node, he can read, write and modify data resources related to the insurance business.

[0080] The forecast authority and the plan authority are integrated to determine the allocation authority of the processor. The integration method can be, but is not limited to, taking the union of the forecast authority and the plan authority as the allocation authority, taking the intersection of the forecast authority and the plan authority as the allocation authority, etc.

[0081] For example, the planned permissions of processor A are: he can read, write and delete data resources related to the insurance business within the restricted time of the resource configuration node; the predicted permissions of processor A are: he can read, write and modify data resources related to the insurance business within the restricted time of the resource configuration node; then the allocated permissions of processor A are: he can read, write, delete and modify data resources related to the insurance business within the restricted time of the resource configuration node.

[0082] After determining the assigned permissions of processor A, the server can also display the assigned permissions to the client of the system publisher for manual verification or adjustment by the system publisher. By combining attribute-based access control and pre-trained permission allocation models to jointly determine the assigned permissions of processors, the accuracy and efficiency of permission allocation can be improved.

[0083] In some optional implementations, S230 determines the permission review level based on the system information and the release time, including: determining the importance of the system release based on the system information; determining the urgency of the system release based on the release time; determining the risk level of the system release based on the importance and urgency; determining the permission review level based on the risk level and the correspondence between the pre-established risk level and the permission review level.

[0084] After the server obtains the system information, it can determine the importance of the system release based on the system information. For example, if the system information shows that the system is released for the first time, the system importance is the higher first importance; if the system information shows that the system is a minor version update, the system importance is the lower second importance.

[0085] After the server obtains the release time, it can determine the urgency of the system release based on the release time. For example, if the system information shows that the release time of the system is longer than the preset time period from the current time, the system urgency is the lower first urgency; if the system information shows that the release time of the system is not longer than the preset time period from the current time, the system urgency is the higher second urgency.

[0086] Preset risk weights can be assigned to importance and urgency. By introducing risk weights, the risk level of system release can be determined based on importance and urgency. The risk level of system release can be directly proportional to the system importance and inversely proportional to the system urgency. That is, the higher the system importance, the higher the risk level of system release, and the higher the system urgency, the lower the risk level of system release.

[0087] A risk level threshold can be preset. When the risk level of the system is higher than the risk level threshold, the system is determined to be released at a high risk level. When the risk level of the system is not higher than the risk level threshold, the system is determined to be released at a low risk level. More risk level thresholds can also be preset according to actual conditions, thereby dividing the system release into more risk levels.

[0088] Based on the pre-established correspondence between risk level and authority review level, the authority review level is determined according to the risk level. For example, a high risk level corresponds to a high authority review level, and a low risk level corresponds to a low authority review level.

[0089] The present invention can flexibly determine the authority review level according to the actual situation released by the system, adjust the strictness of authority management according to the actual situation, and improve the flexibility of authority management.

[0090] In some optional implementations, S240 detects whether the processor has exceeded its authority based on the authority review level during the process of the processor processing the transfer node, including: using deep packet inspection technology to obtain the processor's data traffic during the process of the processor processing the transfer node, and determining the processor's access behavior based on the data traffic; obtaining system logs during the process of the processor processing the transfer node, and determining the processor's operation behavior based on the system logs; determining whether the processor has exceeded its authority based on the access behavior, operation behavior, the processor's assigned authority and the authority review level.

[0091] When the processor processes the transfer node through the client, the server monitors the processor's access and operation behaviors by detecting the data flow and system logs of the client corresponding to the processor. Based on the monitoring results, combined with the processor's assigned permissions and permission review level, it is determined whether the processor has exceeded his authority.

[0092] The server can use deep packet inspection technology to obtain the data flow of the processor and determine the processor's access behavior based on the data flow. For example, if the processor's assigned authority is to access data resources related to the insurance field, and the authority review level is a high authority review level (such as data resources outside the unauthorized access rights), and the server obtains the processor's data flow through deep packet inspection technology, it is determined that the processor's access behavior involves accessing data resources related to the medical field, and then it is determined that the processor has exceeded his authority.

[0093] The server can also collect the system logs of the client corresponding to the processor in real time, and determine the processor's operation behavior based on the system logs. For example, if the processor's assigned permissions are to read and write data resources related to the insurance field, and the permission review level is a high permission review level (for example, operations beyond the permissions cannot be performed), and after the server obtains the system logs, it determines that the processor's operation behavior involves deleting data resources related to the insurance field, then it is determined that the processor has exceeded his authority.

[0094] The server uses deep packet inspection technology to monitor the network data traffic in the system release process in real time. Once it finds that there is unauthorized access beyond the assigned authority based on the authority review level, it will immediately determine the possible unauthorized behavior. The server is closely integrated with the system log to analyze the operation records in the system log in real time, extract key information for operation behavior analysis, and immediately determine the possible unauthorized behavior once it finds that there is unauthorized operation beyond the assigned authority based on the authority review level.

[0095] The present invention combines real-time unauthorized detection with authority review levels, and can discover and evaluate the degree of harm of unauthorized behavior in the first place, thereby facilitating subsequent corresponding alarm responses.

[0096] In some optional implementations, if there is any unauthorized behavior, S250 determines the alarm level based on the unauthorized behavior and the authority review level, including: if there is any unauthorized behavior, determining the unauthorized level based on the unauthorized behavior and the authority review level; determining the alarm level based on the unauthorized level and based on a pre-established correspondence between the unauthorized level and the alarm level; and issuing an alarm based on the alarm level.

[0097] Once the server determines that the client corresponding to the processor has exceeded its authority, it will determine the level of the exceeding authority based on the exceeding authority behavior and the authority review level.

[0098] The server can determine different over-authorization values ​​according to different over-authorization behaviors. The more serious the over-authorization behavior, the higher the over-authorization value. The server can determine different permission review limits according to different permission review levels. The higher the permission review level, the higher the permission review limit. The degree of over-authorization is calculated based on the over-authorization value and the permission review limit.

[0099] A threshold value of the degree of unauthorized access may be preset. When the degree of unauthorized access is higher than the threshold value, the level of unauthorized access is determined to be a high level. When the degree of unauthorized access is not higher than the threshold value, the level of unauthorized access is determined to be a low level. More threshold values ​​of unauthorized access may be preset according to actual conditions, thereby dividing more levels of unauthorized access.

[0100] Based on the pre-established correspondence between the level of unauthorized access and the level of alarm, the alarm level is determined according to the level of unauthorized access. For example, a high level of unauthorized access corresponds to a high alarm level, such as interrupting the system release process and locking the assigned permissions of the processor; a low level of unauthorized access corresponds to a low alarm level, such as issuing an alarm to the system publisher and recording the unauthorized behavior.

[0101] By issuing an alarm, the system's self-protection capability can be improved when it is released. The most appropriate alarm response strategy is adopted according to different unauthorized behaviors and authority review levels, reducing the losses caused by unauthorized behavior.

[0102] In some optional implementations, the method further includes: after the system is released, counting and recording data on unauthorized behavior.

[0103] After the system is released, the data of unauthorized behaviors in the system release process is analyzed and summarized, so as to evaluate the unauthorized results of the system release, and provide reference and improvement basis for the subsequent system release.

[0104] By counting the results of unauthorized actions in the historical system release process, we can continuously adjust and optimize strategies such as authority allocation, authority review level determination, and alarm level determination based on the processing results and effects of historical unauthorized actions, thereby further improving the accuracy of authority management.

[0105] The method provided by the present invention has good scalability and compatibility, can be integrated with existing systems and security technologies, and reduces implementation costs and difficulty.

[0106] See also Figure 3 As shown, Figure 3 Another flowchart of a rights management method for system publishing provided by an embodiment of the present invention includes the following steps:

[0107] Step S301, in response to receiving a system release instruction, displaying a system information control, a release time control, a flow node control, and a processor control, and determining the system information, release time, flow node, and the processor corresponding to the flow node based on the received input result; then proceed to step S302 and step S303;

[0108] Step S302, according to the system information and the flow node, attribute-based access control is used to determine the planning authority of the processor; then go to step S304;

[0109] Step S303, inputting the system information and the flow nodes into the pre-trained authority allocation model to obtain the predicted authority of the processor; wherein the authority allocation model is obtained by training the constructed basic authority allocation model according to the historical system information, the historical flow nodes and the authority of the processor corresponding to the historical flow nodes; then proceeding to step S304;

[0110] Step S304, determine the allocation authority of the processor according to the forecast authority and the planning authority; then go to step S305 and step S306;

[0111] Step S305, determining the importance of the system release according to the system information; then proceeding to step S307;

[0112] Step S306, determine the urgency of the system release according to the release time; then go to step S307;

[0113] Step S307, determine the risk level issued by the system according to the importance and urgency, and determine the authority review level according to the risk level based on the pre-established correspondence between the risk level and the authority review level; then go to step S308 and step S309;

[0114] Step S308, when the processor processes the flow node, the deep packet inspection technology is used to obtain the processor's data flow, and the processor's access behavior is determined according to the data flow; then, the process goes to step S310;

[0115] Step S309, when the processor processes the flow node, the system log is obtained, and the operation behavior of the processor is determined according to the system log; then the process goes to step S310;

[0116] Step S310, based on the access behavior, operation behavior, the assigned authority of the processor and the authority review level, determine whether the processor has exceeded its authority; if so, go to step S311; if not, go to step S308 and step S309;

[0117] Step S311, determining the level of unauthorized behavior and the level of authority review, determining the alarm level based on the level of unauthorized behavior and the pre-established correspondence between the level of unauthorized behavior and the alarm level, and issuing an alarm based on the alarm level; then proceeding to step S312;

[0118] Step S312: After the system is released, the data of unauthorized behavior is counted and recorded.

[0119] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0120] In one embodiment, a rights management device for system publishing is provided, and the rights management device for system publishing corresponds one-to-one to the rights management method for system publishing in the above embodiment.

[0121] like Figure 4 As shown, the rights management device for system release includes:

[0122] The information acquisition module 401 is used to receive system release request information; wherein the system release request information includes: system information, release time, flow node and the processor corresponding to the flow node;

[0123] The authority management module 402 is used to assign authority to corresponding processors according to system information and flow nodes;

[0124] The risk assessment module 403 is used to determine the authority review level according to the system information and the release time;

[0125] The unauthorized detection module 404 is used to detect whether the processor has unauthorized behavior according to the authority review level during the process of the processor processing the flow node;

[0126] The alarm response module 405 is used to determine the alarm level according to the unauthorized behavior and the authority review level when there is unauthorized behavior.

[0127] In some optional implementations, the information acquisition module 401 is specifically used to: display a receiving control for the system release request information; wherein the receiving control includes: a system information control, a release time control, a flow node control, and a processor control; receive the input results of the receiving control, determine the system information, release time, flow node, and the processor corresponding to the flow node.

[0128] In some optional implementations, the permission management module 402 is specifically used to: determine the planned permissions of the processor based on system information and flow nodes using attribute-based access control; input the system information and flow nodes into a pre-trained permission allocation model to obtain the predicted permissions of the processor; wherein the permission allocation model is obtained by training a constructed basic permission allocation model based on historical system information, historical flow nodes, and historical permissions of historical processors corresponding to historical flow nodes; and determine the allocated permissions of the processor based on the predicted permissions and planned permissions.

[0129] In some optional implementations, the risk assessment module 403 is specifically used to: determine the importance of the system release based on the system information; determine the urgency of the system release based on the release time; determine the risk level of the system release based on the importance and urgency; determine the authority review level based on the risk level and the correspondence between the pre-established risk level and the authority review level.

[0130] In some optional implementations, the unauthorized detection module 404 is specifically used to: use deep packet inspection technology to obtain the data flow of the processor during the process of the processor processing the flow node, and determine the access behavior of the processor based on the data flow; obtain system logs during the process of the processor processing the flow node, and determine the operating behavior of the processor based on the system logs; determine whether the processor has unauthorized behavior based on the access behavior, operating behavior, the processor's allocated authority and the authority review level.

[0131] In some optional implementations, the alarm response module 405 is specifically used to: when there is an unauthorized behavior, determine the level of unauthorized behavior according to the unauthorized behavior and the authority review level; determine the alarm level according to the level of unauthorized behavior based on a pre-established correspondence between the level of unauthorized behavior and the alarm level; and issue an alarm according to the alarm level.

[0132] In some optional implementations, the device further includes a statistical module for counting and recording data on unauthorized behavior after the system is released.

[0133] For the specific definition of the rights management device for system release, please refer to the definition of the rights management method for system release mentioned above, which will not be repeated here. Each module in the above-mentioned rights management device for system release can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0134] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 5As shown. The computer device includes a processor, a memory, a network interface and a database connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile and / or volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external client via a network connection. When the computer program is executed by the processor, it implements a function or step on the server side of a rights management method for system release.

[0135] In one embodiment, a computer device is provided. The computer device may be a client, and its internal structure diagram may be as follows: Figure 6 As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external server through a network connection. When the computer program is executed by the processor, it implements the functions or steps of a client side of a rights management method for system release

[0136] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0137] Receiving system release request information; wherein the system release request information includes: system information, release time, flow node and the processor corresponding to the flow node;

[0138] Assign permissions to corresponding processors based on system information and flow nodes;

[0139] Determine the permission review level based on system information and release time;

[0140] When the processor is processing the flow node, check whether the processor has exceeded his authority according to the authority review level;

[0141] If there is any unauthorized behavior, the alarm level will be determined based on the unauthorized behavior and the authority review level.

[0142] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0143] Receiving system release request information; wherein the system release request information includes: system information, release time, flow node and the processor corresponding to the flow node;

[0144] Assign permissions to corresponding processors based on system information and flow nodes;

[0145] Determine the permission review level based on system information and release time;

[0146] When the processor is processing the flow node, check whether the processor has exceeded his authority according to the authority review level;

[0147] If there is any unauthorized behavior, the alarm level will be determined based on the unauthorized behavior and the authority review level.

[0148] It should be noted that the above functions or steps that can be implemented by the computer-readable storage medium or computer device can refer to the relevant descriptions on the server side and the client side in the aforementioned method embodiment. To avoid repetition, they will not be described one by one here.

[0149] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0150] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0151] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A rights management method for system release, characterized in that: include: Receive system release request information; wherein the system release request information includes: system information, release time, flow node and the processor corresponding to the flow node; Allocate authority to the corresponding processor according to the system information and the flow node; Determine the authority review level according to the system information and the release time; In the process of the processor processing the flow node, detecting whether the processor has exceeded its authority according to the authority review level; If the unauthorized behavior occurs, an alarm is issued according to the alarm level determined based on the unauthorized behavior and the authority review level.

2. The rights management method for system release according to claim 1, characterized in that: The receiving system release request information; wherein the system release request information includes: system information, release time, flow node and the processor corresponding to the flow node, including: Display the receiving control of the system publishing request information; wherein the receiving control includes: system information control, publishing time control, flow node control and processor control; Receive the input result of the receiving control, and determine the system information, the publishing time, the flow node, and the processor corresponding to the flow node.

3. The rights management method for system release according to claim 1, characterized in that: The allocating authority to the corresponding processor according to the system information and the transfer node includes: According to the system information and the flow node, attribute-based access control is used to determine the planning authority of the processor; Input the system information and the flow node into a pre-trained authority allocation model to obtain the predicted authority of the processor; wherein the authority allocation model is obtained by training a constructed basic authority allocation model based on historical system information, historical flow nodes, and historical authorities of historical processors corresponding to the historical flow nodes; The allocation authority of the processor is determined according to the forecast authority and the planning authority.

4. The rights management method for system release according to claim 1, characterized in that: Determining the authority review level according to the system information and the release time includes: Determining the importance of the system release according to the system information; Determining the urgency of the release of the system according to the release time; Determining a risk level of the system release according to the importance and the urgency; According to the risk level, based on a pre-established correspondence between the risk level and the authority review level, the authority review level is determined.

5. The rights management method for system release according to claim 1, characterized in that: In the process of the processor processing the transfer node, detecting whether the processor has exceeded its authority according to the authority review level includes: In the process of the processor processing the transfer node, the data flow of the processor is obtained by using deep packet inspection technology, and the access behavior of the processor is determined according to the data flow; In the process of the processor processing the flow node, obtaining a system log, and determining the operation behavior of the processor according to the system log; It is determined whether the processor has exceeded its authority based on the access behavior, the operation behavior, the assigned authority of the processor and the authority review level.

6. The rights management method for system release according to claim 1, characterized in that: If the unauthorized behavior exists, the alarm level is determined according to the unauthorized behavior and the authority review level to issue an alarm, including: If the above-mentioned unauthorized behavior exists, the level of unauthorized behavior is determined according to the above-mentioned unauthorized behavior and the level of authority review; Determining the alarm level according to the unauthorized level and based on a pre-established correspondence between the unauthorized level and the alarm level; An alarm is issued according to the alarm level.

7. The rights management method for system release according to claim 1, characterized in that: The method further comprises: After the system is released, the data of the unauthorized behavior will be counted and recorded.

8. A rights management device for system release, characterized in that: include: An information acquisition module, used to receive system release request information; wherein the system release request information includes: system information, release time, flow node and the processor corresponding to the flow node; A rights management module, used to assign rights to the corresponding processor according to the system information and the flow node; A risk assessment module, used to determine the authority review level according to the system information and the release time; An unauthorized detection module is used to detect whether the processor has unauthorized behavior according to the authority review level during the process of the processor processing the flow node; The alarm response module is used to determine the alarm level according to the unauthorized behavior and the authority review level when the unauthorized behavior exists.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the rights management method for system release as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the rights management method for system release as claimed in any one of claims 1 to 7 are implemented.

Images